From July 1, 2026, the Law on Cyber Security 2025 sets out a remarkable requirement: some agencies, organizations and state-owned enterprises must allocate at least 15% of the total funding for the implementation of digital transformation investment programs, schemes and projects, and the application of information technology to protect cybersecurity. The regulation seems to be just a percentage of the budget, but when it comes into practice, it raises a series of questions: What is the 15% calculated on, who is required to apply and how to spend it to both comply with the law, and avoid formal investment and financial waste for businesses?
The new law goes one step further when quantifying the minimum rate.
From "spending if there is a budget" to a mandatory component
One of the notable new points of the Law on Cyber Security is the regulation on funding for cyber security protection. The new regulation[1] requires agencies, organizations, state-owned enterprises, political organizations, socio-political organizations and public non-business units guaranteed by the state budget to allocate funds for cyber security protection in their annual expenditure estimates for the implementation of digital transformation and information technology application tasks. Accordingly, these entities must "allocate at least 15% of the total funding for the implementation of programs, schemes and projects on investment in digital transformation and application of information technology to protect cybersecurity".
This is an important change in approach. Previously, Decree 53/2022/ND-CP guiding the Law on Cyber Security 2018 stipulated that funding for ensuring cyber security in the operation of state agencies and political organizations at the central and local levels is guaranteed by the state budget. For public investment projects to build, expand or upgrade information systems, investment funds for cyber security are allocated in the investment capital of the corresponding project.
The new law goes one step further when quantifying the minimum rate. That means, for the scope of Clause 1 of Article 38, cyber security is no longer an item that can be considered after the information technology system has been designed, but must be taken into account right from the process of programming, schemes, projects and resource allocation. In other words, the mindset of "build the system first, have money, buy security later" is no longer suitable in principle when the new regulations take effect.
What amount is 15% charged on?
The rate of 15% is "the total budget for the implementation of programs, schemes and projects on investment in digital transformation and application of information technology". Therefore, it should not be understood that an agency must spend 15% of the entire annual operating budget on cybersecurity.
For example, an agency has a total operating budget of VND 500 billion in the year, but implements a digital transformation project with a total budget of VND 20 billion. If the project falls within the scope of application of Clause 1, Article 38, the minimum ratio in principle is determined to be over VND 20 billion of the project, not VND 500 billion of the agency's budget. According to the calculation directly from the law, a project of VND 20 billion must be allocated at least VND 3 billion for cyber security protection.
Similarly, if an information technology application project has a total budget of 100 billion VND, the funding for cyber security protection according to the minimum threshold will be 15 billion VND.
The calculation of 15% is the first step. For projects implemented for many years, where the total investment is adjusted or the initial investment cost is combined with the operating cost, it is necessary to clarify which total funding is used as the basis and the time to determine the ratio. Article 38 sets the minimum level but does not solve all problems of adjustment, allocation and settlement by itself; the application must also compare the law on budget, public investment, bidding and relevant guidance.
The point to pay special attention to is the law that uses the phrase "15% minimum". This is the floor level, not the ceiling. A system with high security requirements, handling critical data, or facing a large cybersecurity risk may absolutely need a higher rate of investment.
On the contrary, reaching the full figure of 15% in accounting does not mean that it has fully met the requirements of cyber security protection. Expenditure must still be associated with actual needs, investment efficiency and corresponding system protection obligations.
Another issue is that the project was approved before July 1, 2026 but continued to be implemented after the effective date of the Law. Whether or not the approved funding structure needs to be adjusted according to the transitional regulations (if any), the legal status and capital source of each project; it should not be applied retroactively or automatically exempted.
Does every business have to spend 15%?
Another misleading point is the scope of subjects subject to regulation. The Law on Cyber Security does not stipulate that all enterprises operating in Vietnam must devote 15% of their information technology budget to cybersecurity. The group directly mentioned by the law includes: agencies and organizations; state-owned enterprises; political organizations; socio-political organizations; and public non-business units guaranteed by the state budget.
For agencies, organizations and units not falling within the scope of Clause 1, Article 38, the Law does not set a minimum funding allocation rate of 15%, but requires these entities to self-finance cyber security protection. The fact that the 15% rate is not required does not mean that they are exempted from other cyber security obligations according to the law.
This distinction is particularly important for the private sector. Businesses that are not subject to the minimum rate of 15% are not allowed to take cybersecurity lightly: depending on the system, data, services and business activities, the enterprise must still meet the corresponding protection obligations.
The legal-financial issue is not only about allocating enough proportions, but also determining which expenditures really serve cyber security protection and have sufficient grounds for recording, appraisal, acceptance and settlement.
Allocating 15% is not necessarily spent correctly
If you understand that cybersecurity is simply buying firewalls, anti-malware software or security devices, the deployment is very easy to fall into the situation of "spending enough proportion" but the defense efficiency is low.
A cybersecurity system is essentially multi-layered. Resources can be related to attack detection and monitoring solutions, identity and access management, data protection, backup and recovery, security testing and assessment, incident response, network infrastructure and endpoint protection, vulnerability management, personnel training, hiring cybersecurity services, or operating a cybersecurity monitoring center.
The legal-financial issue is not only about allocating enough proportions, but also determining which expenditures really serve cyber security protection and have sufficient grounds for recording, appraisal, acceptance and settlement.
Not every product has a technology component, its full value automatically counts towards 15%. A cloud computing platform, for example, may include computing resources, storage, data transfer, and security functions. If the contract does not separate the components, determining which part of the cybersecurity protection is actually funded can become problematic when appraisal, audited, or finalized.
Therefore, right from the design and estimation stage, the investor needs to separate protection objectives, technical solutions, cost items and proof documents. Whether an expense such as data backup, training or cloud service rental is included in the network security budget is based on the actual function and applicable financial regulations; the entire contract value should not be calculated by default.
The new regulation also entails changes in the investment preparation process. The spirit of this regulation is that cybersecurity must become a component of the project from the very beginning. Therefore, when developing a program, scheme or project, the investor needs to simultaneously identify the assets and data to be protected, the risk and attack scenario, the technical requirements, the protection plan, the initial investment cost and the operating cost.
It is also necessary to separate three stages: making and approving estimates to allocate funds; deploying and procuring in accordance with objectives and regulations; and finally, acceptance and settlement based on volume and valid documents. The term "arrangement" in the law should not be equated with the requirement to spend all a sum of money at all costs.
From budget ratio to substantive protection effectiveness
The problem can be visualized through a hypothetical situation.
A province implements a shared data platform project with a total budget of 200 billion VND. If the project falls within the scope of Clause 1, Article 38 of the Law on Security, the minimum funding for cyber security protection will be 30 billion VND. But the work does not stop at multiplying 200 billion VND by 15%.
The investor must determine which layers of protection the 30 billion VND will address: infrastructure security; access control; data protection; attack monitoring; backup and recovery; vulnerability assessment; security testing; incident response; or related operational services.
More importantly, it must be demonstrated that the investment structure is suitable for the architecture and risk level of the system itself.
If the initial technical plan has not used up all the expected resources, the investor needs to review the scope, structure and protection needs of the project in accordance with regulations, instead of purchasing unnecessary equipment just to achieve the ratio. On the contrary, if the protection demand exceeds VND 30 billion, the minimum rate cannot be used as a basis for investment limits. It is necessary to distinguish the allocation of funds according to the law from the obligation to actually spend, accept and settle according to the corresponding financial regulations.
The regulation to devote a minimum of 15% of funding to cybersecurity protection marks a change in the approach to digital transformation investment: cybersecurity must be taken into account right from the resource planning stage. However, the challenge lies not in the calculation of 15%, but in determining the right scope of application, basis of allocation and efficiency of using funds. A project can meet the budget ratio but still be insecure if resources are used incorrectly. Compliance with the 15% regulation is therefore a requirement for investment management and cybersecurity risks, not merely the fulfillment of a financial target.
[1] According to Clause 1, Article 38, the Law on Cyber Security
